diff options
| author | Simon Glass <sjg@chromium.org> | 2021-02-15 17:08:12 -0700 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2021-02-15 22:31:54 -0500 |
| commit | 3f04db891a353f4b127ed57279279f851c6b4917 (patch) | |
| tree | 2de8580b23f833e100a186448625721d71625521 /test | |
| parent | 124c255731c76a2b09587378b2bcce561bcd3f2d (diff) | |
| download | u-boot-3f04db891a353f4b127ed57279279f851c6b4917.tar.gz u-boot-3f04db891a353f4b127ed57279279f851c6b4917.tar.xz u-boot-3f04db891a353f4b127ed57279279f851c6b4917.zip | |
image: Check for unit addresses in FITs
Using unit addresses in a FIT is a security risk. Add a check for this
and disallow it.
CVE-2021-27138
Signed-off-by: Simon Glass <sjg@chromium.org>
Reported-by: Bruce Monroe <bruce.monroe@intel.com>
Reported-by: Arie Haenel <arie.haenel@intel.com>
Reported-by: Julien Lenoir <julien.lenoir@intel.com>
Diffstat (limited to 'test')
| -rw-r--r-- | test/py/tests/test_vboot.py | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/test/py/tests/test_vboot.py b/test/py/tests/test_vboot.py index 22e8fc10d8..6dff6779d1 100644 --- a/test/py/tests/test_vboot.py +++ b/test/py/tests/test_vboot.py @@ -232,8 +232,8 @@ def test_vboot(u_boot_console, sha_algo, padding, sign_options, required, util.run_and_log(cons, [fit_check_sign, '-f', fit, '-k', dtb]) if full_test: - # Make sure that U-Boot checks that the config is in the list of hashed - # nodes. If it isn't, a security bypass is possible. + # Make sure that U-Boot checks that the config is in the list of + # hashed nodes. If it isn't, a security bypass is possible. ffit = '%stest.forged.fit' % tmpdir shutil.copyfile(fit, ffit) with open(ffit, 'rb') as fd: @@ -263,10 +263,11 @@ def test_vboot(u_boot_console, sha_algo, padding, sign_options, required, shutil.copyfile(fit, efit) vboot_evil.add_evil_node(fit, efit, evil_kernel, 'kernel@') + msg = 'Signature checking prevents use of unit addresses (@) in nodes' util.run_and_log_expect_exception( cons, [fit_check_sign, '-f', efit, '-k', dtb], - 1, 'Node name contains @') - run_bootm(sha_algo, 'evil kernel@', 'Bad Data Hash', False, efit) + 1, msg) + run_bootm(sha_algo, 'evil kernel@', msg, False, efit) # Create a new properly signed fit and replace header bytes make_fit('sign-configs-%s%s.its' % (sha_algo, padding)) |